$npx -y skills add Archive228/loopkit --skill input-validationValidate and constrain untrusted input at the boundary. Use on any handler that accepts external data.
| 1 | # Input Validation |
| 2 | Validate at the edge, before the data touches logic or storage. |
| 3 | - **Schema** — type, required fields, allowed values. Reject unknown fields rather than ignoring them. |
| 4 | - **Bounds** — string length, number ranges, array size. An unbounded input is a DoS and a memory bomb. |
| 5 | - **Format** — emails, UUIDs, dates parsed and re-validated, not trusted as strings. |
| 6 | - **Files** — size limit, type allowlist (check content, not just extension), no path traversal in names. |
| 7 | - Reject with a clear 4xx and a message that says what's wrong — without leaking internals. |
| 8 | Never trust "it comes from our own frontend". The request can come from anywhere. |